CVE-2026-116195

Rclone versions prior to 1.75.2 are vulnerable to a path traversal vulnerability in the local backend's translateLink function. The issue occurs because the software trims the .rclonelink suffix from a path after performing the containment check, allowing names to resolve outside the intended des...

EUVD-2026-109453

Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a sour...